Under the Health Insurance Portability and Accountability Act ("HIPAA") Privacy Rule, providers and lawyers must be cautious when responding to requests for protected health information ("PHI").

       In general, covered entities are prohibited from using or disclosing PHI without written authorization from the patient except for treatment, payment or health care operations.  Even when disclosure is allow under HIPAA, only the “minimum necessary” information to accomplish the purpose of the use, disclosure or request is permitted.  The exception to this general rule is the disclosure permitted by a covered entity in response to: (a) a subpoena, discovery request or court order; or (b) an order of a court or administrative tribunal.  Compliance with these two requests, however, is very different.

       HIPAA allows a covered entity to disclose PHI in the course of any traditional or administrative proceeding in response to an order of the court or administrative tribunal provided that only the PHI expressly authorized by such order is disclosed.  This means a court order signed by a judge who directs a provider to release an individual′s medical information specified in a court order signed by a judge even without patient authorization.  However, the covered entity can disclose only the PHI expressly authorized in the court order and no more.

       When a request for PHI comes in the form of a subpoena or discovery request, the covered entity can legally release the PHI only if:

1. It receives satisfactory assurances from the party seeking the information that reasonable efforts have been made to ensure the patient has been given notice of the request; or
2. It receives satisfactory assurances from the party seeking the information that reasonable efforts have been made to secure a qualified protective order.

       In the event a covered entity does not receive satisfactory assurances from the party seeking the information, the covered entity can make reasonable efforts to provide written notice to the patient itself or seek a qualified protective order from the court.

       Any covered entity that receives a subpoena, discovery request or other lawful process requesting PHI must evaluate whether the legal standards described above have been satisfied. Please contact us if you receive any subpoena, discovery request or other demand for PHI so that we can properly advise you and your practice on how to proceed.